canonical: https://jentic.com/apis/axiorank.com/axiorank # AxioRank Gateway API The AxioRank Gateway API scores each agent tool call for an allow or hold verdict, verifies inbound agent requests, and preflights external servers before an agent connects. It mints short-lived scoped tokens from a long-lived key and writes every decision to a tamper-evident audit log that you can export to a SIEM or verify offline with signed receipts and checkpoints. Public transparency-log endpoints let anyone read tool-definition history and inclusion proofs. ## For AI agents Govern what your AI agent is allowed to do at runtime: score each tool call for an allow or hold verdict, verify inbound agent requests, mint short-lived scoped tokens, and export a signed audit trail. Covers 22 endpoints for policy checks and tamper-evident logging. ## Scope Does not store your agent's data, run the agent, or manage credentials for third-party services. Use for scoring, verifying, and auditing agent actions only. ## Capabilities - Score an agent's proposed tool call and get an allow or hold verdict before it runs - Hold risky tool calls for human approval and poll the approval by its id - Verify an inbound agent request before your service acts on it - Mint short-lived scoped tokens from a long-lived AxioRank key - Export signed audit logs to a SIEM and issue offline-verifiable receipts - Read transparency-log checkpoints, tool-definition history, and inclusion proofs ## Use cases ### Gate agent tool calls through Jentic Put a policy check in front of every tool your AI agent can run. The agent sends each proposed call to AxioRank, which returns an allow or hold verdict, and only allowed calls execute while held ones route to approval. Through Jentic the gateway operation is discovered by intent and called with its input schema, so the check sits in the loop without hand-wiring the bearer auth. Example prompt: Score a proposed tool call with POST `/api/v1/gateway/tool-call` and execute it only if the verdict is allow, otherwise hold it for approval ### Human-in-the-loop approvals Require a person to sign off on sensitive agent actions without blocking the whole run. When AxioRank returns a hold verdict it issues an approval you poll until a human allows or denies it, so the agent pauses on exactly the calls that need review and continues on the rest. Example prompt: Poll a held tool call with GET `/api/v1/gateway/approvals/{approvalId}` until the decision is returned, then proceed or abort ### Tamper-evident audit trail Keep a verifiable record of what your agent did. AxioRank writes every verdict to an append-only log you can export to a SIEM, issue offline-verifiable receipts for individual rows, and reconcile against signed checkpoints, so an auditor can confirm nothing was altered after the fact. Example prompt: Export the recent audit log with GET `/api/v1/audit/export` and issue a receipt for a specific row with GET `/api/v1/audit/receipt/{auditLogId}` ### Short-lived scoped credentials Avoid handing a long-lived key to the agent runtime. AxioRank exchanges a key for a short-lived token scoped to the capabilities the agent needs, so the token expires quickly and carries only the access you granted, keeping the blast radius small. Example prompt: Exchange a key for a short-lived token with POST `/api/v1/gateway/token` requesting only the scopes the agent needs ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | `/api/v1/gateway/tool-call` | Score a tool call for an allow or hold verdict | | GET | `/api/v1/gateway/approvals/{approvalId}` | Poll a held tool call | | POST | `/api/v1/gateway/verify-request` | Verify an inbound agent request | | POST | `/api/v1/gateway/token` | Exchange a key for a short-lived token | | GET | `/api/v1/audit/export` | Export audit logs to a SIEM | | GET | `/api/v1/audit/receipt/{auditLogId}` | Issue an offline-verifiable receipt for an audit row | | GET | `/api/v1/audit/public-key` | Fetch transparency-log public keys | ## Key resources - **Gateway** — Score, hold, and verify agent tool calls and inbound requests, preflight external servers, and mint short-lived tokens - **Audit** — Export logs to a SIEM, issue offline-verifiable receipts, and read signed checkpoints for a log - **Transparency log** — Read the public tool-definition transparency log, server history, entries, and inclusion proofs ## AI readiness This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use. - **Score:** 64 / 100 - **Maturity:** AI-Aware - **Dimensions:** - Foundational Compliance: 87 / 100 - Developer Experience & Jentic Compatibility: 62 / 100 - AI-Readiness & Agent Experience: 43 / 100 - Agent Usability: 94 / 100 - Security: 60 / 100 - AI Discoverability: 91 / 100 - **View full report:** https://jentic.com/apis/axiorank.com/axiorank/scorecard - **How the score is calculated:** https://docs.jentic.com/reference/api-readiness-framework/overview/ - **More about the dimensions:** https://docs.jentic.com/reference/api-readiness-framework/specification/#dimensional-model-overview ### Score it yourself Every API in the directory is allowlisted, so you can re-score it with no key required. - **Score your own API:** https://jentic.com/scorecard.md - **Scoring CLI agent skill:** https://github.com/jentic/jentic-api-scorecard/blob/main/skills/jentic-api-scorecard/SKILL.md ```sh npx @jentic/api-scorecard-cli score ``` ## Why Jentic - **Setup:** Wiring AxioRank by hand means learning its bearer auth, minting short-lived tokens, and polling held approvals yourself. Through Jentic you install once, import AxioRank from the API Directory, store the token once, and your agent calls it. - **Permission scoping:** AxioRank puts resource ids in the URL path, such as the approval id in `/api/v1/gateway/approvals/{approvalId}`, so a rule can bound your agent to specific audit and approval reads. You choose which operations it may call, so sensitive ones like minting tokens or exporting the full audit log are not included unless you add them. - **Credential handling:** Your AxioRank token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'score a tool call' or 'export the audit log', and Jentic returns the matching AxioRank operation with its input schema so the agent calls the right endpoint without reading the reference docs. ## Related APIs - **Oso Cloud** — Oso Cloud is an authorization service for application permissions; AxioRank scores and audits agent tool calls at runtime. - **Open Policy Agent** — Open Policy Agent evaluates general-purpose Rego policies; AxioRank is a hosted gateway purpose-built for scoring agent actions with an audit trail. - **Unkey API** — Unkey issues and verifies API keys for your own API; AxioRank governs and audits what an agent does once it is authenticated. ## FAQ ### What authentication does the AxioRank Gateway API use? The AxioRank Gateway API authenticates with a bearer token per its OpenAPI spec: send an API key (an agent key or property key) or a short-lived token as `Authorization: Bearer `. A few endpoints, such as the transparency-log public keys and receipt verification, are public and need no token. Through Jentic the token is stored encrypted by your own Jentic One instance and injected at call time. ### Can I hold an agent's tool call for human approval with the AxioRank Gateway API? Yes. Score the proposed call, and when the verdict is hold, AxioRank returns an approval you poll at the approvals endpoint until a human allows or denies it. The gateway also verifies inbound agent requests and preflights an external server before your agent connects to it. ### Can I limit what my agent is allowed to do with the AxioRank Gateway API? Yes. Write a rule that allows only the tool-call scoring and approval-polling operations, so your agent can get verdicts and wait on held calls but cannot mint tokens or export the full audit log, and the calls it makes are logged. AxioRank carries ids such as the approval id in the URL path, so those reads can be bound to a specific resource. ### What are the rate limits for the AxioRank Gateway API? The OpenAPI spec does not specify rate limits. Check the AxioRank documentation at https://axiorank.com for current limits before putting the gateway in a high-volume agent loop. ### Is there an AxioRank MCP server? You don't need an MCP server to give your agent AxioRank. Jentic connects it directly from the API Directory: import it, store your token once, and your agent calls the gateway and audit operations on demand. That also keeps extra tool definitions out of the agent's context. ### How do I score an agent tool call with the AxioRank Gateway API through Jentic? Search Jentic for 'score an agent tool call' and it returns the AxioRank tool-call operation with its input schema. Your agent sends the proposed call, AxioRank replies with an allow or hold verdict, and held calls route to the approvals endpoint. To run it on your own infrastructure, install Jentic One from its GitHub repo.